Correct Answer: A process where a Data Encryption Key (DEK) is used to encrypt the data, and that DEK is then encrypted with a Key Encryption Key (KEK) from Cloud KMS
Envelope encryption is more efficient for large amounts of data, as the large data isn't sent to KMS for encryption....
Correct Answer
A process where a Data Encryption Key (DEK) is used to encrypt the data, and that DEK is then encrypted with a Key Encryption Key (KEK) from Cloud KMS
Why This Answer Is Correct
Envelope encryption is more efficient for large amounts of data, as the large data isn't sent to KMS for encryption.
This question evaluates your knowledge of Cloud Key Management Service — a core concept tested in Associate Cloud Engineer. Understanding Cloud Key Management Service is essential for designing scalable, secure, and cost-effective cloud architectures. Mastery of this topic will help you answer scenario-based questions confidently on exam day.
Company policy requires that all database encryption keys be managed centrally and rotated annually. You need a secure, durable service to store and manage these cryptographic keys. Which service should you use?
Which Google Cloud service allows you to manage cryptographic keys (AES-256, RSA, etc.) at scale and use them to protect your data-at-rest?
What is the difference between a 'Key Ring' and a 'CryptoKey' in Cloud KMS?
What is 'Automatic Key Rotation' in Cloud KMS?
Which Cloud KMS feature provides Hardware Security Module (HSM) protection (FIPS 140-2 Level 3) for your keys without requiring you to manage physical hardware?